Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

CVE-2025-27221 identifies a security flaw in the Ruby URI gem prior to version 1.0.3, specifically in the handling of Uniform Resource Identifiers (URIs). The vulnerability arises because the URI handling methods—URI.join, URI#merge, and URI#+—do not properly remove the userinfo component (which contains authentication credentials such as username and password) when the host portion of the URI is changed. This results in the inadvertent retention and potential leakage of sensitive authentication credentials during URI manipulation. The flaw is categorized under CWE-212, which refers to the improper removal of sensitive information before storage or transfer. The vulnerability has a CVSS v3.1 base score of 3.2, indicating low severity due to factors such as local attack vector (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and limited confidentiality impact (C:L). There are no known exploits in the wild, and the issue primarily threatens confidentiality without affecting integrity or availability. The affected versions include 0, 0.12.0, 0.13.0, and 1.0.0 of the URI gem. The root cause is that when URI methods modify the host, they fail to clear the userinfo field, which can lead to sensitive credentials being unintentionally propagated or exposed in logs, error messages, or downstream systems. This can be particularly problematic in web applications or services that dynamically construct or manipulate URIs for API calls, redirects, or resource access. The recommended remediation is to upgrade to URI gem version 1.0.3 or later, where this issue has been fixed. Additionally, developers should audit their codebases for unsafe URI manipulations that might retain sensitive information and implement secure coding practices to avoid credential leakage.

Detailed information about CVE-2025-27221: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer in ruby-lang URI affecting ruby-lang URI

CVE-2025-27221: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer in ruby-lang URI - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-27221: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer in ruby-lang URI

ruby

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CVE-2023-28755 is a vulnerability classified as a Regular Expression Denial of Service (ReDoS) affecting the URI parser component in Ruby versions through 3.2.1. The issue stems from the parser mishandling invalid URLs containing specific characters, which leads to excessive backtracking in the regular expression engine. This results in a significant increase in execution time when parsing such crafted URI strings, effectively causing a denial-of-service condition by exhausting CPU resources. The vulnerability does not compromise confidentiality or integrity but impacts availability by slowing or halting services that rely on URI parsing. Exploitation requires no authentication or user interaction, and the attack vector is remote, as an attacker can send maliciously crafted URIs to vulnerable applications. The vulnerability is tracked under CWE-1333, which relates to ReDoS issues caused by inefficient regular expressions. Fixed versions of Ruby addressing this vulnerability include 0.12.1, 0.11.1, 0.10.2, and 0.10.0.1. While no known exploits are currently reported in the wild, the medium CVSS score of 5.3 reflects the moderate impact and ease of exploitation. This vulnerability is particularly relevant for web applications and services written in Ruby that parse user-supplied URIs, where an attacker could disrupt service availability by triggering the ReDoS condition.

Detailed information about CVE-2023-28755: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-28755: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-28755: n/a


CVE-2025-27221: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer in ruby-lang URICVE-2025-27221 0 In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. LowVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-27221 #cwe-212 Join the discussion	CVE Database V5	03/03/2025, 00:00:00 UTC Added: 11/03/2025, 20:49:00 UTC
CVE-2023-28755: n/aCVE-2023-28755 0 A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. MediumVulnerabilityUnited KingdomGermanyFrance+3#cve #cve-2023-28755 Join the discussion	CVE Database V5	03/31/2023, 00:00:00 UTC Added: 11/03/2025, 19:38:17 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional